cbor-x 1.3.3 → 1.4.1

package/SECURITY.md

@@ -1,11 +1,11 @@
-# Security Policy
-
-## Supported Versions
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 0.9.x   | :white_check_mark: |
-
-## Reporting a Vulnerability
-
-Please report security vulnerabilities to kriszyp@gmail.com.
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.9.x   | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities to kriszyp@gmail.com.

package/benchmark.md

@@ -1,73 +1,73 @@
-Here are more comprehensive benchmarks. This is comparison with the next fastest JS projects using the benchmark tool from `msgpack-lite` (and data is from some clinical research data we use that has a good mix of different value types and structures). It also includes comparison to V8 native JSON functionality, and JavaScript Avro (`avsc`, a very optimized Avro implementation):
-
-operation                                                  |   op   |   ms  |  op/s
----------------------------------------------------------- | ------: | ----: | -----:
-buf = Buffer(JSON.stringify(obj));                         |   82000 |  5004 |  16386
-obj = JSON.parse(buf);                                     |   88600 |  5000 |  17720
-require("cbor-x").encode(obj);                             |  161500 |  5002 |  32287
-require("cbor-x").decode(buf);                           |   94600 |  5004 |  18904
-cbor-x w/ shared structures: encoder.encode(obj);            |  178400 |  5002 |  35665
-cbor-x w/ shared structures: encoder.decode(buf);          |  376700 |  5000 |  75340
-buf = require("cbor").encode(obj);                         |    7700 |  5008 |   1537
-obj = require("cbor").decode(buf);                         |    3100 |  5119 |    605
-buf = require("cbor-sync").encode(obj);                    |   18000 |  5025 |   3582
-obj = require("cbor-sync").decode(buf);                    |   20900 |  5011 |   4170
-buf = require("msgpack-lite").encode(obj);                 |   30100 |  5012 |   6005
-obj = require("msgpack-lite").decode(buf);                 |   16200 |  5001 |   3239
-buf = require("@msgpack/msgpack").encode(obj);             |  101200 |  5001 |  20235
-obj = require("@msgpack/msgpack").decode(buf);             |   71200 |  5004 |  14228
-buf = require("notepack").encode(obj);                     |   62600 |  5005 |  12507
-obj = require("notepack").decode(buf);                     |   32400 |  5007 |   6470
-require("what-the-pack")... encoder.encode(obj);           |   63500 |  5002 |  12694
-require("what-the-pack")... encoder.decode(buf);           |   32000 |  5001 |   6398
-require("avsc")...make schema/type...type.toBuffer(obj);   |   84600 |  5003 |  16909
-require("avsc")...make schema/type...type.toBuffer(obj);   |   99300 |  5001 |  19856
-
-(`avsc` is schema-based and more comparable in style to cbor-x with shared structures).
-
-Here is a benchmark of streaming data (again borrowed from `msgpack-lite`'s benchmarking), where cbor-x is able to take advantage of the structured record extension and really pull away from other tools:
-
-operation (1000000 x 2)                          |   op    |  ms   |  op/s
------------------------------------------------- | ------: | ----: | -----:
-new EncoderStream().write(obj);                  | 1000000 |   533 | 1876172
-new DecoderStream().write(buf);                  | 1000000 |   297 | 3367003
-stream.write(msgpack.encode(obj));               | 1000000 |  3179 | 314564
-stream.write(msgpack.decode(buf));               | 1000000 |  2151 | 464900
-stream.write(notepack.encode(obj));              | 1000000 |   944 | 1059322
-stream.write(notepack.decode(buf));              | 1000000 |  1131 | 884173
-msgpack.Encoder().on("data",ondata).encode(obj); | 1000000 |  1687 | 592768
-msgpack.createDecodeStream().write(buf);         | 1000000 |  2084 | 479846
-msgpack.createEncodeStream().write(obj);         | 1000000 |  1475 | 677966
-msgpack.Decoder().on("data",ondata).decode(buf); | 1000000 |  2264 | 441696
-
-
-
-These are the benchmarks from notepack package. The larger test data for these benchmarks is very heavily weighted with large binary/buffer data and objects with extreme numbers of keys (much more than I typically see with real-world data, but YMMV):
-
-node ./benchmarks/encode
-
-library          |   tiny            |  small          | medium         | large
----------------- | ----------------: | --------------: | ---------------| -------:
-notepack         | 2,171,621 ops/sec | 546,905 ops/sec | 29,578 ops/sec | 265 ops/sec   
-msgpack-js       | 967,682 ops/sec   | 184,455 ops/sec | 20,556 ops/sec | 259 ops/sec   
-cbor-x         | 2,392,826 ops/sec | 556,915 ops/sec | 70,573 ops/sec | 313 ops/sec   
-msgpack-lite     | 553,143 ops/sec   | 132,318 ops/sec | 11,816 ops/sec | 186 ops/sec   
-@msgpack/msgpack | 2,157,655 ops/sec | 573,236 ops/sec | 25,864 ops/sec | 90.26 ops/sec 
-
-
-node ./benchmarks/decode
-
-library          |   tiny            |  small          | medium          | large
----------------- | ----------------: | --------------: | --------------- | -------:
-notepack         | 2,220,904 ops/sec | 560,630 ops/sec | 28,177 ops/sec  | 275 ops/sec   
-msgpack-js       | 965,719 ops/sec   | 222,047 ops/sec | 21,431 ops/sec  | 257 ops/sec   
-cbor-x         | 2,320,046 ops/sec | 589,167 ops/sec | 70,299 ops/sec  | 329 ops/sec   
-cbor-x records | 3,750,547 ops/sec | 912,419 ops/sec | 136,853 ops/sec | 733 ops/sec   
-msgpack-lite     | 569,222 ops/sec   | 129,008 ops/sec | 12,424 ops/sec  | 180 ops/sec   
-@msgpack/msgpack | 2,089,697 ops/sec | 557,507 ops/sec | 20,256 ops/sec  | 85.03 ops/sec 
-
-This was run by adding the cbor-x to the benchmarks for notepack.
-
-All benchmarks were performed on Node 14.8.0 (Windows i7-4770 3.4Ghz). They can be run with:
-npm install --no-save msgpack msgpack-js @msgpack/msgpack msgpack-lite notepack avsc
-node tests/benchmark
+Here are more comprehensive benchmarks. This is comparison with the next fastest JS projects using the benchmark tool from `msgpack-lite` (and data is from some clinical research data we use that has a good mix of different value types and structures). It also includes comparison to V8 native JSON functionality, and JavaScript Avro (`avsc`, a very optimized Avro implementation):
+
+operation                                                  |   op   |   ms  |  op/s
+---------------------------------------------------------- | ------: | ----: | -----:
+buf = Buffer(JSON.stringify(obj));                         |   82000 |  5004 |  16386
+obj = JSON.parse(buf);                                     |   88600 |  5000 |  17720
+require("cbor-x").encode(obj);                             |  161500 |  5002 |  32287
+require("cbor-x").decode(buf);                           |   94600 |  5004 |  18904
+cbor-x w/ shared structures: encoder.encode(obj);            |  178400 |  5002 |  35665
+cbor-x w/ shared structures: encoder.decode(buf);          |  376700 |  5000 |  75340
+buf = require("cbor").encode(obj);                         |    7700 |  5008 |   1537
+obj = require("cbor").decode(buf);                         |    3100 |  5119 |    605
+buf = require("cbor-sync").encode(obj);                    |   18000 |  5025 |   3582
+obj = require("cbor-sync").decode(buf);                    |   20900 |  5011 |   4170
+buf = require("msgpack-lite").encode(obj);                 |   30100 |  5012 |   6005
+obj = require("msgpack-lite").decode(buf);                 |   16200 |  5001 |   3239
+buf = require("@msgpack/msgpack").encode(obj);             |  101200 |  5001 |  20235
+obj = require("@msgpack/msgpack").decode(buf);             |   71200 |  5004 |  14228
+buf = require("notepack").encode(obj);                     |   62600 |  5005 |  12507
+obj = require("notepack").decode(buf);                     |   32400 |  5007 |   6470
+require("what-the-pack")... encoder.encode(obj);           |   63500 |  5002 |  12694
+require("what-the-pack")... encoder.decode(buf);           |   32000 |  5001 |   6398
+require("avsc")...make schema/type...type.toBuffer(obj);   |   84600 |  5003 |  16909
+require("avsc")...make schema/type...type.toBuffer(obj);   |   99300 |  5001 |  19856
+
+(`avsc` is schema-based and more comparable in style to cbor-x with shared structures).
+
+Here is a benchmark of streaming data (again borrowed from `msgpack-lite`'s benchmarking), where cbor-x is able to take advantage of the structured record extension and really pull away from other tools:
+
+operation (1000000 x 2)                          |   op    |  ms   |  op/s
+------------------------------------------------ | ------: | ----: | -----:
+new EncoderStream().write(obj);                  | 1000000 |   533 | 1876172
+new DecoderStream().write(buf);                  | 1000000 |   297 | 3367003
+stream.write(msgpack.encode(obj));               | 1000000 |  3179 | 314564
+stream.write(msgpack.decode(buf));               | 1000000 |  2151 | 464900
+stream.write(notepack.encode(obj));              | 1000000 |   944 | 1059322
+stream.write(notepack.decode(buf));              | 1000000 |  1131 | 884173
+msgpack.Encoder().on("data",ondata).encode(obj); | 1000000 |  1687 | 592768
+msgpack.createDecodeStream().write(buf);         | 1000000 |  2084 | 479846
+msgpack.createEncodeStream().write(obj);         | 1000000 |  1475 | 677966
+msgpack.Decoder().on("data",ondata).decode(buf); | 1000000 |  2264 | 441696
+
+
+
+These are the benchmarks from notepack package. The larger test data for these benchmarks is very heavily weighted with large binary/buffer data and objects with extreme numbers of keys (much more than I typically see with real-world data, but YMMV):
+
+node ./benchmarks/encode
+
+library          |   tiny            |  small          | medium         | large
+---------------- | ----------------: | --------------: | ---------------| -------:
+notepack         | 2,171,621 ops/sec | 546,905 ops/sec | 29,578 ops/sec | 265 ops/sec   
+msgpack-js       | 967,682 ops/sec   | 184,455 ops/sec | 20,556 ops/sec | 259 ops/sec   
+cbor-x         | 2,392,826 ops/sec | 556,915 ops/sec | 70,573 ops/sec | 313 ops/sec   
+msgpack-lite     | 553,143 ops/sec   | 132,318 ops/sec | 11,816 ops/sec | 186 ops/sec   
+@msgpack/msgpack | 2,157,655 ops/sec | 573,236 ops/sec | 25,864 ops/sec | 90.26 ops/sec 
+
+
+node ./benchmarks/decode
+
+library          |   tiny            |  small          | medium          | large
+---------------- | ----------------: | --------------: | --------------- | -------:
+notepack         | 2,220,904 ops/sec | 560,630 ops/sec | 28,177 ops/sec  | 275 ops/sec   
+msgpack-js       | 965,719 ops/sec   | 222,047 ops/sec | 21,431 ops/sec  | 257 ops/sec   
+cbor-x         | 2,320,046 ops/sec | 589,167 ops/sec | 70,299 ops/sec  | 329 ops/sec   
+cbor-x records | 3,750,547 ops/sec | 912,419 ops/sec | 136,853 ops/sec | 733 ops/sec   
+msgpack-lite     | 569,222 ops/sec   | 129,008 ops/sec | 12,424 ops/sec  | 180 ops/sec   
+@msgpack/msgpack | 2,089,697 ops/sec | 557,507 ops/sec | 20,256 ops/sec  | 85.03 ops/sec 
+
+This was run by adding the cbor-x to the benchmarks for notepack.
+
+All benchmarks were performed on Node 14.8.0 (Windows i7-4770 3.4Ghz). They can be run with:
+npm install --no-save msgpack msgpack-js @msgpack/msgpack msgpack-lite notepack avsc
+node tests/benchmark

package/browser.js

@@ -1,11 +1,11 @@
-exports.Encoder = require('./encode').Encoder
-exports.Decoder = require('./decode').Decoder
-exports.addExtension = require('./encode').addExtension
-let encoder = new exports.Encoder({ useRecords: false })
-exports.decode = encoder.decode
-exports.encode = encoder.encode
-Object.assign(exports, {
-	ALWAYS:1,
-	DECIMAL_ROUND: 3,
-	DECIMAL_FIT: 4
-})
+exports.Encoder = require('./encode').Encoder
+exports.Decoder = require('./decode').Decoder
+exports.addExtension = require('./encode').addExtension
+let encoder = new exports.Encoder({ useRecords: false })
+exports.decode = encoder.decode
+exports.encode = encoder.encode
+Object.assign(exports, {
+	ALWAYS:1,
+	DECIMAL_ROUND: 3,
+	DECIMAL_FIT: 4
+})

package/decode.d.ts

@@ -1,46 +1,2 @@
-export enum FLOAT32_OPTIONS {
-	NEVER = 0,
-	ALWAYS = 1,
-	DECIMAL_ROUND = 3,
-	DECIMAL_FIT = 4
-}
-
-export interface Options {
-	useFloat32?: FLOAT32_OPTIONS
-	useRecords?: boolean
-	structures?: {}[]
-	structuredClone?: boolean
-	mapsAsObjects?: boolean
-	variableMapSize?: boolean
-	copyBuffers?: boolean
-	bundleStrings?: boolean
-	useTimestamp32?: boolean
-	largeBigIntToFloat?: boolean
-	encodeUndefinedAsNil?: boolean
-	maxSharedStructures?: number
-	maxOwnStructures?: number
-	useSelfDescribedHeader?: boolean
-	keyMap?: {}
-	shouldShareStructure?: (keys: string[]) => boolean
-	getStructures?(): {}[]
-	saveStructures?(structures: {}[]): boolean | void
-	onInvalidDate?: () => any
-}
-interface Extension {
-	Class: Function
-	tag: number
-	encode(value: any): Buffer | Uint8Array
-	decode(messagePack: Buffer | Uint8Array): any
-}
-export class Decoder {
-	constructor(options?: Options)
-	decode(messagePack: Buffer | Uint8Array): any
-	decodeMultiple(messagePack: Buffer | Uint8Array, forEach?: (value: any) => any): [] | void
-}
-export function decode(messagePack: Buffer | Uint8Array): any
-export function decodeMultiple(messagePack: Buffer | Uint8Array, forEach?: (value: any) => any): [] | void
-export function addExtension(extension: Extension): void
-export function clearSource(): void
-export function roundFloat32(float32Number: number): number
-export let isNativeAccelerationEnabled: boolean
-
+export { decode, decodeMultiple, Decoder, addExtension, clearSource,roundFloat32, isNativeAccelerationEnabled,
+	Extension, Options, FLOAT32_OPTIONS} from '.'

package/decode.js

@@ -84,7 +84,7 @@ export class Decoder {
 		}
 		let res = {}
 		//map.forEach((v,k) => res[Object.keys(this._keyMap)[Object.values(this._keyMap).indexOf(k)] || k] = v)
-		map.forEach((v,k) => res[this._mapKey.has(k) ? this._mapKey.get(k) : k] =  v)
+		map.forEach((v,k) => res[safeKey(this._mapKey.has(k) ? this._mapKey.get(k) : k)] =  v)
 		return res
 	}
 	
@@ -289,8 +289,8 @@ export function read() {
 						let key
 						if (currentDecoder.mapsAsObjects) {
 							let object = {}
-							if (currentDecoder.keyMap) while((key = read()) != STOP_CODE) object[currentDecoder.decodeKey(key)] = read()
-							else while ((key = read()) != STOP_CODE) object[key] = read()
+							if (currentDecoder.keyMap) while((key = read()) != STOP_CODE) object[safeKey(currentDecoder.decodeKey(key))] = read()
+							else while ((key = read()) != STOP_CODE) object[safeKey(key)] = read()
 							return object
 						} else {
 							if (restoreMapsAsObject) {
@@ -338,8 +338,8 @@ export function read() {
 		case 5: // map
 			if (currentDecoder.mapsAsObjects) {
 				let object = {}
-				if (currentDecoder.keyMap) for (let i = 0; i < token; i++) object[currentDecoder.decodeKey(read())] = read()
-				else for (let i = 0; i < token; i++) object[read()] = read()
+				if (currentDecoder.keyMap) for (let i = 0; i < token; i++) object[safeKey(currentDecoder.decodeKey(read()))] = read()
+				else for (let i = 0; i < token; i++) object[safeKey(read())] = read()
 				return object
 			} else {
 				if (restoreMapsAsObject) {
@@ -455,8 +455,8 @@ function createStructureReader(structure) {
 		if (this.slowReads++ >= 3) { // create a fast compiled reader
 			let array = this.length == length ? this : this.slice(0, length)
 			compiledReader = currentDecoder.keyMap 
-			? new Function('r', 'return {' + array.map(k => currentDecoder.decodeKey(k)).map(k => validName.test(k) ? k + ':r()' : ('[' + JSON.stringify(k) + ']:r()')).join(',') + '}')
-			: new Function('r', 'return {' + array.map(key => validName.test(key) ? key + ':r()' : ('[' + JSON.stringify(key) + ']:r()')).join(',') + '}')
+			? new Function('r', 'return {' + array.map(k => currentDecoder.decodeKey(k)).map(k => validName.test(k) ? safeKey(k) + ':r()' : ('[' + JSON.stringify(k) + ']:r()')).join(',') + '}')
+			: new Function('r', 'return {' + array.map(key => validName.test(key) ? safeKey(key) + ':r()' : ('[' + JSON.stringify(key) + ']:r()')).join(',') + '}')
 			if (this.compiledReader)
 				compiledReader.next = this.compiledReader // if there is an existing one, we store multiple readers as a linked list because it is usually pretty rare to have multiple readers (of different length) for the same structure
 			compiledReader.propertyCount = length
@@ -464,14 +464,20 @@ function createStructureReader(structure) {
 			return compiledReader(read)
 		}
 		let object = {}
-		if (currentDecoder.keyMap) for (let i = 0; i < length; i++) object[currentDecoder.decodeKey(this[i])] = read()
-		else for (let i = 0; i < length; i++) object[this[i]] = read()
+		if (currentDecoder.keyMap) for (let i = 0; i < length; i++) object[safeKey(currentDecoder.decodeKey(this[i]))] = read()
+		else for (let i = 0; i < length; i++) {
+			object[safeKey(this[i])] = read();
+		}
 		return object
 	}
 	structure.slowReads = 0
 	return readObject
 }
 
+function safeKey(key) {
+	return key === '__proto__' ? '__proto_' : key
+}
+
 let readFixedString = readStringJS
 let readString8 = readStringJS
 let readString16 = readStringJS
@@ -737,18 +743,30 @@ function readExt(length) {
 	else
 		throw new Error('Unknown extension type ' + type)
 }
-
+let f32Array = new Float32Array(1)
+let u8Array = new Uint8Array(f32Array.buffer, 0, 4)
 function getFloat16() {
 	let byte0 = src[position++]
 	let byte1 = src[position++]
-	let half = (byte0 << 8) + byte1
-	let exp = (half >> 10) & 0x1f
-	let mant = half & 0x3ff
-	let val
-	if (exp == 0) val = Math.exp(mant, -24)
-	else if (exp != 31) val = Math.exp(mant + 1024, exp - 25)
-	else val = mant == 0 ? Infinity : NaN
-	return half & 0x8000 ? -val : val
+	let exponent = (byte0 & 0x7f) >> 2;
+	if (exponent === 0x1f) { // specials
+		if (byte1 || (byte0 & 3))
+			return NaN;
+		return (byte0 & 0x80) ? -Infinity : Infinity;
+	}
+	if (exponent === 0) { // sub-normals
+		// significand with 10 fractional bits and divided by 2^14
+		let abs = (((byte0 & 3) << 8) | byte1) / (1 << 24)
+		return (byte0 & 0x80) ? -abs : abs
+	}
+
+	u8Array[3] = (byte0 & 0x80) | // sign bit
+		((exponent >> 1) + 56) // 4 of 5 of the exponent bits, re-offset-ed
+	u8Array[2] = ((byte0 & 7) << 5) | // last exponent bit and first two mantissa bits
+		(byte1 >> 3) // next 5 bits of mantissa
+	u8Array[1] = byte1 << 5; // last three bits of mantissa
+	u8Array[0] = 0;
+	return f32Array[0];
 }
 
 let keyCache = new Array(4096)
@@ -822,8 +840,6 @@ export class Tag {
 	}
 }
 
-let glbl = typeof self == 'object' ? self : global
-
 currentExtensions[0] = (dateString) => {
 	// string date extension
 	return new Date(dateString)
@@ -871,11 +887,11 @@ const recordDefinition = (definition) => {
 	let object = {}
 	if (currentDecoder.keyMap) for (let i = 2,l = definition.length; i < l; i++) {
 			let key = currentDecoder.decodeKey(structure[i - 2])
-			object[key] = definition[i]
+			object[safeKey(key)] = definition[i]
 		}
 	else for (let i = 2,l = definition.length; i < l; i++) {
 			let key = structure[i - 2]
-			object[key] = definition[i]
+			object[safeKey(key)] = definition[i]
 		}
 	return object
 }
@@ -890,7 +906,7 @@ currentExtensions[15] = (value) => {
 		return bundledStrings[1].slice(bundledStrings.position1, bundledStrings.position1 += value)
 	return new Tag(value, 15)
 }
-
+let glbl = { Error, RegExp }
 currentExtensions[27] = (data) => { // http://cbor.schmorp.de/generic-object
 	return (glbl[data[0]] || Error)(data[1], data[2])
 }
@@ -1015,13 +1031,17 @@ currentExtensionRanges.push((tag, input) => {
 })
 
 const isLittleEndianMachine = new Uint8Array(new Uint16Array([1]).buffer)[0] == 1
-export const typedArrays = ['Uint8', 'Uint8Clamped', 'Uint16', 'Uint32', 'BigUint64','Int8', 'Int16', 'Int32', 'BigInt64', 'Float32', 'Float64']
+export const typedArrays = [Uint8Array, Uint8ClampedArray, Uint16Array, Uint32Array,
+	typeof BigUint64Array == 'undefined' ? { name:'BigUint64Array' } : BigUint64Array, Int8Array, Int16Array, Int32Array,
+	typeof BigInt64Array == 'undefined' ? { name:'BigInt64Array' } : BigInt64Array, Float32Array, Float64Array]
 const typedArrayTags = [64, 68, 69, 70, 71, 72, 77, 78, 79, 85, 86]
 for (let i = 0; i < typedArrays.length; i++) {
 	registerTypedArray(typedArrays[i], typedArrayTags[i])
 }
-function registerTypedArray(typedArrayId, tag, littleEndian) {
-	let TypedArray = glbl[typedArrayId + 'Array']
+function registerTypedArray(TypedArray, tag) {
+	let dvMethod = 'get' + TypedArray.name.slice(0, -5)
+	if (typeof TypedArray !== 'function')
+		TypedArray = null;
 	let bytesPerElement = TypedArray.BYTES_PER_ELEMENT
 	for (let littleEndian = 0; littleEndian < 2; littleEndian++) {
 		if (!littleEndian && bytesPerElement == 1)
@@ -1038,7 +1058,7 @@ function registerTypedArray(typedArrayId, tag, littleEndian) {
 			let dv = new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength)
 			let elements = buffer.length >> sizeShift
 			let ta = new TypedArray(elements)
-			let method = dv['get' + typedArrayId]
+			let method = dv[dvMethod]
 			for (let i = 0; i < elements; i++) {
 				ta[i] = method.call(dv, i << sizeShift, littleEndian)
 			}
@@ -1158,8 +1178,6 @@ export const FLOAT32_OPTIONS = {
 	DECIMAL_ROUND: 3,
 	DECIMAL_FIT: 4
 }
-let f32Array = new Float32Array(1)
-let u8Array = new Uint8Array(f32Array.buffer, 0, 4)
 export function roundFloat32(float32Number) {
 	f32Array[0] = float32Number
 	let multiplier = mult10[((u8Array[3] & 0x7f) << 1) | (u8Array[2] >> 7)]